[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7ACY4SSZ1ZYC0NEBBJSADKQ":3,"skill-same:01M7ACY4SSZ1ZYC0NEBBJSADKQ":50},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":32,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":35,"install":36,"resources":49},"01M7ACY4SSZ1ZYC0NEBBJSADKQ","security-audit",null,"Application security audit covering OWASP Top 10, STRIDE threat modeling, and secrets archaeology.\nUse when: security review, pre-launch audit, dependency scanning.","bravew\u002FNeumar","bravew","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F10855844?v=4","01M7ACJ91JZSQYHT81XPVYR7VA","Yong","01M7ACJ92CH2PCT42AG4GYHFV7",12,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fbravew\u002FNeumar\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: security-audit\ndescription: |\n  Application security audit covering OWASP Top 10, STRIDE threat modeling, and secrets archaeology.\n  Use when: security review, pre-launch audit, dependency scanning.\nversion: 1.0.0\ntrigger: \u002Fsecurity\ncategory: development\nicon: shield\n---\n\n> When generating output, use the user's preferred language for all headings, labels, and prose.\n\n## Overview\n\nA comprehensive application security audit methodology. Covers code-level vulnerabilities, architectural threats, and supply chain risks.\n\n## Phase 1: Threat Model (STRIDE)\n\nBefore scanning code, understand the attack surface:\n\n| Threat | Question | Example |\n|--------|----------|---------|\n| **S**poofing | Can someone pretend to be another user? | Missing auth, weak session management |\n| **T**ampering | Can someone modify data in transit or at rest? | Unsigned cookies, unvalidated input |\n| **R**epudiation | Can actions be denied without evidence? | Missing audit logs |\n| **I**nformation Disclosure | Can sensitive data leak? | Verbose errors, debug endpoints |\n| **D**enial of Service | Can the system be overwhelmed? | Missing rate limits, unbounded queries |\n| **E**levation of Privilege | Can someone gain unauthorized access? | Broken access control, IDOR |\n\n## Phase 2: OWASP Top 10 Scan\n\nCheck each vulnerability category systematically:\n\n### A01: Broken Access Control\n- [ ] Authorization checks on every endpoint\n- [ ] No IDOR (Insecure Direct Object Reference) vulnerabilities\n- [ ] CORS policy properly configured\n- [ ] Directory traversal protections\n\n### A02: Cryptographic Failures\n- [ ] Sensitive data encrypted at rest and in transit\n- [ ] Strong algorithms (no MD5\u002FSHA1 for security)\n- [ ] Proper key management (no hardcoded keys)\n\n### A03: Injection\n- [ ] SQL injection — parameterized queries everywhere\n- [ ] Command injection — no user input in shell commands\n- [ ] XSS — output encoding in templates\n- [ ] LDAP\u002FNoSQL injection where applicable\n\n### A04: Insecure Design\n- [ ] Rate limiting on authentication endpoints\n- [ ] Account lockout after failed attempts\n- [ ] Secure defaults (deny by default)\n\n### A05: Security Misconfiguration\n- [ ] Debug mode disabled in production\n- [ ] Default credentials changed\n- [ ] Error messages don't leak stack traces\n- [ ] Unnecessary features\u002Fendpoints removed\n\n### A06: Vulnerable Components\n- [ ] Dependencies have no known CVEs\n- [ ] Dependencies are actively maintained\n- [ ] Lockfile integrity verified\n\n### A07: Authentication Failures\n- [ ] Strong password requirements\n- [ ] MFA available for sensitive operations\n- [ ] Session management secure (httpOnly, secure, sameSite)\n\n### A08: Data Integrity Failures\n- [ ] CI\u002FCD pipeline integrity\n- [ ] Dependency integrity verification\n- [ ] Unsigned data deserialization guarded\n\n### A09: Logging Failures\n- [ ] Security events logged (login, access denied, errors)\n- [ ] Logs don't contain sensitive data\n- [ ] Log injection prevented\n\n### A10: SSRF\n- [ ] User-supplied URLs validated\n- [ ] Internal network access blocked\n- [ ] Cloud metadata endpoints blocked\n\n## Phase 3: Secrets Archaeology\n\nScan for hardcoded credentials and leaked secrets:\n\n1. **Pattern scan** — Search codebase for:\n   - API keys, tokens, passwords in source code\n   - `.env` files committed to git\n   - Private keys or certificates\n   - Connection strings with credentials\n\n2. **Git history** — Check if secrets were ever committed:\n   - `git log --all -p | grep -i \"password\\|secret\\|key\\|token\"`\n   - Check for `.env` files in history even if now in `.gitignore`\n\n3. **Configuration files** — Verify:\n   - `.gitignore` includes sensitive files\n   - Environment variables used for secrets\n   - No secrets in CI\u002FCD configuration\n\n## Phase 4: Dependency Audit\n\n1. Check for known CVEs in dependencies\n2. Review dependency age and maintenance status\n3. Assess permission scope of packages\n4. Verify no typosquatting in package names\n\n## Output Format\n\n```\n## Security Audit Report\n\n**Scope**: [what was audited]\n**Date**: [audit date]\n**Risk Level**: Critical | High | Medium | Low\n\n### Findings\n\n#### [CRITICAL] Finding Title\n- **Vulnerability**: [type, e.g., SQL Injection]\n- **Location**: [file:line]\n- **Impact**: [what an attacker could do]\n- **CWE**: [CWE reference if applicable]\n- **Remediation**: [specific fix]\n\n### Summary\n| Severity | Count |\n|----------|-------|\n| Critical | N |\n| High | N |\n| Medium | N |\n| Low | N |\n```\n","> When generating output, use the user's preferred language for all headings, labels, and prose.\n\n## Overview\n\nA comprehensive application security audit methodology. Covers code-level vulnerabilities, architectural threats, and supply chain risks.\n\n## Phase 1: Threat Model (STRIDE)\n\nBefore scanning code, understand the attack surface:\n\n| Threat | Question | Example |\n|--------|----------|---------|\n| **S**poofing | Can someone pretend to be another user? | Missing auth, weak session management |\n| **T**ampering | Can someone modify data in transit or at rest? | Unsigned cookies, unvalidated input |\n| **R**epudiation | Can actions be denied without evidence? | Missing audit logs |\n| **I**nformation Disclosure | Can sensitive data leak? | Verbose errors, debug endpoints |\n| **D**enial of Service | Can the system be overwhelmed? | Missing rate limits, unbounded queries |\n| **E**levation of Privilege | Can someone gain unauthorized access? | Broken access control, IDOR |\n\n## Phase 2: OWASP Top 10 Scan\n\nCheck each vulnerability category systematically:\n\n### A01: Broken Access Control\n- [ ] Authorization checks on every endpoint\n- [ ] No IDOR (Insecure Direct Object Reference) vulnerabilities\n- [ ] CORS policy properly configured\n- [ ] Directory traversal protections\n\n### A02: Cryptographic Failures\n- [ ] Sensitive data encrypted at rest and in transit\n- [ ] Strong algorithms (no MD5\u002FSHA1 for security)\n- [ ] Proper key management (no hardcoded keys)\n\n### A03: Injection\n- [ ] SQL injection — parameterized queries everywhere\n- [ ] Command injection — no user input in shell commands\n- [ ] XSS — output encoding in templates\n- [ ] LDAP\u002FNoSQL injection where applicable\n\n### A04: Insecure Design\n- [ ] Rate limiting on authentication endpoints\n- [ ] Account lockout after failed attempts\n- [ ] Secure defaults (deny by default)\n\n### A05: Security Misconfiguration\n- [ ] Debug mode disabled in production\n- [ ] Default credentials changed\n- [ ] Error messages don't leak stack traces\n- [ ] Unnecessary features\u002Fendpoints removed\n\n### A06: Vulnerable Components\n- [ ] Dependencies have no known CVEs\n- [ ] Dependencies are actively maintained\n- [ ] Lockfile integrity verified\n\n### A07: Authentication Failures\n- [ ] Strong password requirements\n- [ ] MFA available for sensitive operations\n- [ ] Session management secure (httpOnly, secure, sameSite)\n\n### A08: Data Integrity Failures\n- [ ] CI\u002FCD pipeline integrity\n- [ ] Dependency integrity verification\n- [ ] Unsigned data deserialization guarded\n\n### A09: Logging Failures\n- [ ] Security events logged (login, access denied, errors)\n- [ ] Logs don't contain sensitive data\n- [ ] Log injection prevented\n\n### A10: SSRF\n- [ ] User-supplied URLs validated\n- [ ] Internal network access blocked\n- [ ] Cloud metadata endpoints blocked\n\n## Phase 3: Secrets Archaeology\n\nScan for hardcoded credentials and leaked secrets:\n\n1. **Pattern scan** — Search codebase for:\n   - API keys, tokens, passwords in source code\n   - `.env` files committed to git\n   - Private keys or certificates\n   - Connection strings with credentials\n\n2. **Git history** — Check if secrets were ever committed:\n   - `git log --all -p | grep -i \"password\\|secret\\|key\\|token\"`\n   - Check for `.env` files in history even if now in `.gitignore`\n\n3. **Configuration files** — Verify:\n   - `.gitignore` includes sensitive files\n   - Environment variables used for secrets\n   - No secrets in CI\u002FCD configuration\n\n## Phase 4: Dependency Audit\n\n1. Check for known CVEs in dependencies\n2. Review dependency age and maintenance status\n3. Assess permission scope of packages\n4. Verify no typosquatting in package names\n\n## Output Format\n\n```\n## Security Audit Report\n\n**Scope**: [what was audited]\n**Date**: [audit date]\n**Risk Level**: Critical | High | Medium | Low\n\n### Findings\n\n#### [CRITICAL] Finding Title\n- **Vulnerability**: [type, e.g., SQL Injection]\n- **Location**: [file:line]\n- **Impact**: [what an attacker could do]\n- **CWE**: [CWE reference if applicable]\n- **Remediation**: [specific fix]\n\n### Summary\n| Severity | Count |\n|----------|-------|\n| Critical | N |\n| High | N |\n| Medium | N |\n| Low | N |\n```\n",{"icon":24,"name":5,"trigger":25,"version":26,"category":27,"description":28},"shield","\u002Fsecurity","1.0.0","development","Application security audit covering OWASP Top 10, STRIDE threat modeling, and secrets archaeology.\nUse when: security review, pre-launch audit, dependency scanning.\n","main","aaca138d7c3773be662941b4081c8d97ea40019c","skills\u002Fsecurity-audit",4,"https:\u002F\u002Fgithub.com\u002Fbravew\u002FNeumar","https:\u002F\u002Fgithub.com\u002Fbravew","2026-11-14 10:00:31",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add bravew\u002FNeumar --skill security-audit",{"tool":42,"command":43},"bunx","bunx skills add bravew\u002FNeumar --skill security-audit",{"tool":45,"command":46},"pnpm","pnpm dlx skills add bravew\u002FNeumar --skill security-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fbravew\u002FNeumar\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002FSKILL.md",true,[],[51,58,65,72,79,87],{"skillNo":52,"name":53,"nameZh":6,"description":54,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":55,"categories":56,"keywords":57,"publishedAt":19},"01M7ACYSWTPZHXD0B5ETTFRGDT","yt-dlp","A robust CLI wrapper for yt-dlp to download videos, playlists, and audio from YouTube and thousands of other sites. Supports format selection, quality control, metadata embedding, and cookie authentication.","https:\u002F\u002Fgithub.com\u002Fbravew\u002FNeumar\u002Fblob\u002Fmain\u002Fskills\u002Fyt-dlp\u002FSKILL.md",[],[],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":19},"01M7ACYREEK21KR5F1NVQFN001","weather","Get current weather and forecasts (no API key required).","https:\u002F\u002Fgithub.com\u002Fbravew\u002FNeumar\u002Fblob\u002Fmain\u002Fskills\u002Fweather\u002FSKILL.md",[],[],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":19},"01M7ACYP9M176F25CH7R844HJZ","video-editing","Video Mode editing guidance for agentic storyboard, timeline, caption, audio, render, and publish work through video_* MCP tools.","https:\u002F\u002Fgithub.com\u002Fbravew\u002FNeumar\u002Fblob\u002Fmain\u002Fskills\u002Fvideo-editing\u002FSKILL.md",[],[],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":19},"01M7ACYJVVTAVCDX4VH75S62XR","video-edit","Conversational video editing workflow for cuts, transcript-based edits, overlays, captions, subtitle burn-in, and render planning with ffmpeg. Use when the user asks to edit video by instruction, cut silence or words, add subtitles, add overlays, transcribe video, or render a final clip.","https:\u002F\u002Fgithub.com\u002Fbravew\u002FNeumar\u002Fblob\u002Fmain\u002Fskills\u002Fvideo-edit\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":83,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":19},"01M7ACYC5X6V4A4EW0C3NRQX0K","skill-creator","Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, update or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.","https:\u002F\u002Fgithub.com\u002Fbravew\u002FNeumar\u002Fblob\u002Fmain\u002Fskills\u002Fskill-creator\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fbravew\u002FNeumar\u002Fblob\u002Fmain\u002Fskills\u002Fskill-creator\u002FSKILL.md",[],[],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":19},"01M7ACY9JKHWXA21JCXJ8VMSVY","ship","Full shipping workflow: test, review, version, changelog, and PR creation.\nUse when: preparing to ship code, creating releases, merging PRs.","https:\u002F\u002Fgithub.com\u002Fbravew\u002FNeumar\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002FSKILL.md",[],[]]