[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7CSHV63MB37YVGAC1PDM49B":3,"skill-same:01M7CSHV63MB37YVGAC1PDM49B":50},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":27,"commitSha":28,"skillDirectory":29,"forksCount":30,"repositoryHtmlUrl":31,"repositoryHomepageUrl":32,"ownerHtmlUrl":33,"ownerBlogUrl":6,"ownerDescription":34,"updatedAt":35,"install":36,"resources":49},"01M7CSHV63MB37YVGAC1PDM49B","access-control-and-idor",null,"Use when the diff adds or changes an endpoint, resolver, RPC, job or query that takes an object id, a role check, a request binding or a tenant filter - BOLA\u002FIDOR, function-level authorization, mass assignment and tenant scoping","makifbaysal\u002Ftasktrooper","makifbaysal","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F25031940?v=4","01M7CRG3ZCSYZSSEVDMW3DEYC8","Mehmet Akif Baysal","01M7CRG401FJ8YAXH5ER730XYV",122,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmakifbaysal\u002Ftasktrooper\u002Fblob\u002Fmain\u002Fcatalog\u002Fagents\u002Fsecurity-agent\u002Fskills\u002Faccess-control-and-idor\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: access-control-and-idor\ncategory: security\ndescription: Use when the diff adds or changes an endpoint, resolver, RPC, job or query that takes an object id, a role check, a request binding or a tenant filter - BOLA\u002FIDOR, function-level authorization, mass assignment and tenant scoping\ntech_stack: Web & API\nsource: original; cloudflare\u002Fsecurity-audit-skill (MIT) access-control questions (parallel paths, per-item bulk checks, body overrides), adapted; informed by trailofbits\u002Fskills (CC BY-SA 4.0, ideas only, own wording); OWASP API Security Top 10 2023, OWASP Top 10:2025 and ASVS 5.0 cited by name only\n---\n# Access Control and IDOR\n\n## Overview\n\nBroken access control is the most common serious finding in real diffs, and it rarely looks dangerous: there is no `exec`, no string-built query — just a lookup by id with nothing after it. You find it by asking one question of every entry point the diff touches:\n\n**\"If user A sends user B's id, what stops it?\"**\n\nIf the answer is not a line of code you can point at, it is a finding.\n\n## 1. Object-Level Authorization (BOLA \u002F IDOR — CWE-639, CWE-862)\n\nEnumerate every id the new code accepts: path, query, body, header, nested in a JSON object, inside a batch array, in a GraphQL argument, in a WebSocket message. Follow each to the data layer.\n\n```go\n\u002F\u002F ❌ any authenticated user reads any invoice\ninv, err := h.repo.Get(ctx, r.PathValue(\"id\"))\n\n\u002F\u002F ✅ scoped to the caller's organisation in the query itself\ninv, err := h.repo.GetForOrg(ctx, r.PathValue(\"id\"), auth.OrgID(ctx))\n```\n\n```kotlin\n\u002F\u002F ❌ Spring: findById alone, the principal is never consulted\n@GetMapping(\"\u002Forders\u002F{id}\") fun get(@PathVariable id: UUID) = repo.findById(id)\n\n\u002F\u002F ✅ ownership is part of the lookup\n@GetMapping(\"\u002Forders\u002F{id}\") fun get(@PathVariable id: UUID, @AuthenticationPrincipal u: User) =\n    repo.findByIdAndCustomerId(id, u.customerId) ?: throw NotFound()\n```\n\nCheck the **second id** too: an endpoint that verifies the project in the path, then updates the task whose id is in the body, without checking the task belongs to that project.\n\n```ts\n\u002F\u002F ❌ project ownership checked, task id from the body never tied to it\nawait assertProjectOwner(req.params.projectId, user.id);\nawait db.task.update({ where: { id: req.body.taskId }, data: { title } });\n\n\u002F\u002F ✅ the task is looked up inside the checked project\nawait db.task.update({ where: { id: req.body.taskId, projectId: req.params.projectId }, data: { title } });\n```\n\n## 2. Function-Level Authorization (BFLA — CWE-285, CWE-863)\n\nA privileged action needs a role check, not just \"logged in\".\n\n- Spring Security: a new `requestMatchers(...).permitAll()` or `.authenticated()` on an admin path; a `@PreAuthorize` removed from a method; a check on the URL that a second mapping of the same handler bypasses.\n- Quarkus: a new resource method with no `@RolesAllowed` where its class's siblings have one; `@PermitAll` added.\n- Express\u002FNest\u002FFastify: a route registered before the auth middleware, or on a router that never mounts it.\n- Django\u002FDRF: `permission_classes = [AllowAny]`, a view missing `@login_required` beside decorated siblings.\n\n```python\n# ❌ DRF: a staff-only action reachable by any authenticated user\n@action(detail=True, methods=[\"post\"])\ndef refund(self, request, pk=None): ...\n\n# ✅ the action carries the same permission as the admin viewset\n@action(detail=True, methods=[\"post\"], permission_classes=[IsAdminUser])\ndef refund(self, request, pk=None): ...\n```\n\n## 3. Property-Level Authorization (mass assignment — CWE-915; excessive exposure — CWE-213)\n\nBinding a request straight onto an entity lets the client set fields it should not: `role`, `isAdmin`, `ownerId`, `orgId`, `price`, `emailVerified`.\n\n```js\n\u002F\u002F ❌ Mongoose: whatever the client sends becomes the document\nconst user = await User.create(req.body);\n\n\u002F\u002F ✅ an explicit allowlist of client-settable fields\nconst { name, email } = req.body;\nconst user = await User.create({ name, email });\n```\n\nEquivalents: Django `ModelForm` \u002F DRF serializer with `fields = \"__all__\"`; Spring `@ModelAttribute` or `@RequestBody` on a JPA entity; Rails `params.permit!`; Pydantic\u002Frequest DTO that includes `role`; Go `json.Decode` into the domain struct. The response side is the mirror: returning the entity serialises `passwordHash`, internal flags or other users' rows in a list.\n\n## 4. Tenant Scoping\n\nIn multi-tenant code, every read and write needs the tenant predicate — including the ones people forget:\n\n- list\u002Fsearch\u002Fexport\u002Fcount endpoints and their pagination cursors;\n- background jobs and queue consumers that receive an id from a message;\n- caches keyed by object id without tenant (one tenant warms, another reads);\n- object storage keys built from a user-supplied filename;\n- GraphQL nested resolvers (the parent was checked, the child field loads by raw id);\n- batch endpoints taking `ids: [...]` — each id must be checked, not the first.\n\n## 5. Failing Open (CWE-280, OWASP A10:2025)\n\n```go\n\u002F\u002F ❌ a lookup error is treated as \"no restriction\"\nperms, err := h.authz.For(ctx, userID)\nif err == nil && !perms.CanDelete { return ErrForbidden }\nreturn h.repo.Delete(ctx, id)\n\n\u002F\u002F ✅ any error denies\nperms, err := h.authz.For(ctx, userID)\nif err != nil || !perms.CanDelete { return ErrForbidden }\n```\n\nAlso: a `switch` on role with a permissive `default`; a feature flag that disables the check when unset; an inverted comparison.\n\n## 6. Parallel Paths to the Same Effect\n\nThe check on the route the diff adds may be right while the same state change stays reachable another way with a weaker one. For each protected effect the diff touches, list every door: the REST route and its GraphQL mutation, the v1 and v2 handlers, the single-item and the bulk endpoint, the import file, the admin tool, the background job, the WebSocket message, the agent tool. Each needs the same permission on the same resource — not authentication alone, and not a permission on a different object. Also ask whether a field in the body can override what the permission system restricts (`\"orgId\"`, `\"ownerId\"`, `\"role\"` in an update body) and whether bulk, export and import enforce the check per item. Tenant scoping across copies and lifecycle — caches, search, exports, soft-delete, revocation — is data-isolation-and-lifecycle.\n\n## Severity Guide\n\n- Reading or changing another tenant's or user's data → HIGH; CRITICAL when unauthenticated, when it reaches credentials or payment data, or when it is admin takeover.\n- Exposure of non-sensitive fields of another user → MEDIUM.\n\n## Common Mistakes\n\n- Reporting \"ids are guessable\": UUIDs are not, and guessability is not the bug — the missing check is. A sequential id with a correct check is fine.\n- Missing a check that exists one layer down: read the repository method; `GetForOwner` may already scope the query.\n- Reporting a missing check in client code — find the server endpoint and judge that.\n- Treating 403 vs 404 as a vulnerability. Follow the repo's convention; it is not your finding.\n\n## Red Flags\n\n- `WHERE id = $1` with no second predicate on a caller-scoped resource.\n- `findById`, `get_object_or_404(Model, pk=pk)`, `Model.findByPk(id)` returning straight to the response.\n- A new route that its neighbours' middleware chain does not cover.\n- A request DTO that is also the entity.\n- An authorization helper whose error path returns `nil`, `true` or falls through.\n\n## References (names and links only)\n\n[OWASP API Security Top 10 2023](https:\u002F\u002Fowasp.org\u002FAPI-Security\u002Feditions\u002F2023\u002Fen\u002F0x11-t10\u002F) — API1 BOLA, API3 BOPLA, API5 BFLA · [OWASP Top 10:2025 A01 Broken Access Control](https:\u002F\u002Fowasp.org\u002FTop10\u002F2025\u002F) · [ASVS 5.0 V8 Authorization](https:\u002F\u002Fgithub.com\u002FOWASP\u002FASVS\u002Ftree\u002Fmaster\u002F5.0\u002Fen)\n","# Access Control and IDOR\n\n## Overview\n\nBroken access control is the most common serious finding in real diffs, and it rarely looks dangerous: there is no `exec`, no string-built query — just a lookup by id with nothing after it. You find it by asking one question of every entry point the diff touches:\n\n**\"If user A sends user B's id, what stops it?\"**\n\nIf the answer is not a line of code you can point at, it is a finding.\n\n## 1. Object-Level Authorization (BOLA \u002F IDOR — CWE-639, CWE-862)\n\nEnumerate every id the new code accepts: path, query, body, header, nested in a JSON object, inside a batch array, in a GraphQL argument, in a WebSocket message. Follow each to the data layer.\n\n```go\n\u002F\u002F ❌ any authenticated user reads any invoice\ninv, err := h.repo.Get(ctx, r.PathValue(\"id\"))\n\n\u002F\u002F ✅ scoped to the caller's organisation in the query itself\ninv, err := h.repo.GetForOrg(ctx, r.PathValue(\"id\"), auth.OrgID(ctx))\n```\n\n```kotlin\n\u002F\u002F ❌ Spring: findById alone, the principal is never consulted\n@GetMapping(\"\u002Forders\u002F{id}\") fun get(@PathVariable id: UUID) = repo.findById(id)\n\n\u002F\u002F ✅ ownership is part of the lookup\n@GetMapping(\"\u002Forders\u002F{id}\") fun get(@PathVariable id: UUID, @AuthenticationPrincipal u: User) =\n    repo.findByIdAndCustomerId(id, u.customerId) ?: throw NotFound()\n```\n\nCheck the **second id** too: an endpoint that verifies the project in the path, then updates the task whose id is in the body, without checking the task belongs to that project.\n\n```ts\n\u002F\u002F ❌ project ownership checked, task id from the body never tied to it\nawait assertProjectOwner(req.params.projectId, user.id);\nawait db.task.update({ where: { id: req.body.taskId }, data: { title } });\n\n\u002F\u002F ✅ the task is looked up inside the checked project\nawait db.task.update({ where: { id: req.body.taskId, projectId: req.params.projectId }, data: { title } });\n```\n\n## 2. Function-Level Authorization (BFLA — CWE-285, CWE-863)\n\nA privileged action needs a role check, not just \"logged in\".\n\n- Spring Security: a new `requestMatchers(...).permitAll()` or `.authenticated()` on an admin path; a `@PreAuthorize` removed from a method; a check on the URL that a second mapping of the same handler bypasses.\n- Quarkus: a new resource method with no `@RolesAllowed` where its class's siblings have one; `@PermitAll` added.\n- Express\u002FNest\u002FFastify: a route registered before the auth middleware, or on a router that never mounts it.\n- Django\u002FDRF: `permission_classes = [AllowAny]`, a view missing `@login_required` beside decorated siblings.\n\n```python\n# ❌ DRF: a staff-only action reachable by any authenticated user\n@action(detail=True, methods=[\"post\"])\ndef refund(self, request, pk=None): ...\n\n# ✅ the action carries the same permission as the admin viewset\n@action(detail=True, methods=[\"post\"], permission_classes=[IsAdminUser])\ndef refund(self, request, pk=None): ...\n```\n\n## 3. Property-Level Authorization (mass assignment — CWE-915; excessive exposure — CWE-213)\n\nBinding a request straight onto an entity lets the client set fields it should not: `role`, `isAdmin`, `ownerId`, `orgId`, `price`, `emailVerified`.\n\n```js\n\u002F\u002F ❌ Mongoose: whatever the client sends becomes the document\nconst user = await User.create(req.body);\n\n\u002F\u002F ✅ an explicit allowlist of client-settable fields\nconst { name, email } = req.body;\nconst user = await User.create({ name, email });\n```\n\nEquivalents: Django `ModelForm` \u002F DRF serializer with `fields = \"__all__\"`; Spring `@ModelAttribute` or `@RequestBody` on a JPA entity; Rails `params.permit!`; Pydantic\u002Frequest DTO that includes `role`; Go `json.Decode` into the domain struct. The response side is the mirror: returning the entity serialises `passwordHash`, internal flags or other users' rows in a list.\n\n## 4. Tenant Scoping\n\nIn multi-tenant code, every read and write needs the tenant predicate — including the ones people forget:\n\n- list\u002Fsearch\u002Fexport\u002Fcount endpoints and their pagination cursors;\n- background jobs and queue consumers that receive an id from a message;\n- caches keyed by object id without tenant (one tenant warms, another reads);\n- object storage keys built from a user-supplied filename;\n- GraphQL nested resolvers (the parent was checked, the child field loads by raw id);\n- batch endpoints taking `ids: [...]` — each id must be checked, not the first.\n\n## 5. Failing Open (CWE-280, OWASP A10:2025)\n\n```go\n\u002F\u002F ❌ a lookup error is treated as \"no restriction\"\nperms, err := h.authz.For(ctx, userID)\nif err == nil && !perms.CanDelete { return ErrForbidden }\nreturn h.repo.Delete(ctx, id)\n\n\u002F\u002F ✅ any error denies\nperms, err := h.authz.For(ctx, userID)\nif err != nil || !perms.CanDelete { return ErrForbidden }\n```\n\nAlso: a `switch` on role with a permissive `default`; a feature flag that disables the check when unset; an inverted comparison.\n\n## 6. Parallel Paths to the Same Effect\n\nThe check on the route the diff adds may be right while the same state change stays reachable another way with a weaker one. For each protected effect the diff touches, list every door: the REST route and its GraphQL mutation, the v1 and v2 handlers, the single-item and the bulk endpoint, the import file, the admin tool, the background job, the WebSocket message, the agent tool. Each needs the same permission on the same resource — not authentication alone, and not a permission on a different object. Also ask whether a field in the body can override what the permission system restricts (`\"orgId\"`, `\"ownerId\"`, `\"role\"` in an update body) and whether bulk, export and import enforce the check per item. Tenant scoping across copies and lifecycle — caches, search, exports, soft-delete, revocation — is data-isolation-and-lifecycle.\n\n## Severity Guide\n\n- Reading or changing another tenant's or user's data → HIGH; CRITICAL when unauthenticated, when it reaches credentials or payment data, or when it is admin takeover.\n- Exposure of non-sensitive fields of another user → MEDIUM.\n\n## Common Mistakes\n\n- Reporting \"ids are guessable\": UUIDs are not, and guessability is not the bug — the missing check is. A sequential id with a correct check is fine.\n- Missing a check that exists one layer down: read the repository method; `GetForOwner` may already scope the query.\n- Reporting a missing check in client code — find the server endpoint and judge that.\n- Treating 403 vs 404 as a vulnerability. Follow the repo's convention; it is not your finding.\n\n## Red Flags\n\n- `WHERE id = $1` with no second predicate on a caller-scoped resource.\n- `findById`, `get_object_or_404(Model, pk=pk)`, `Model.findByPk(id)` returning straight to the response.\n- A new route that its neighbours' middleware chain does not cover.\n- A request DTO that is also the entity.\n- An authorization helper whose error path returns `nil`, `true` or falls through.\n\n## References (names and links only)\n\n[OWASP API Security Top 10 2023](https:\u002F\u002Fowasp.org\u002FAPI-Security\u002Feditions\u002F2023\u002Fen\u002F0x11-t10\u002F) — API1 BOLA, API3 BOPLA, API5 BFLA · [OWASP Top 10:2025 A01 Broken Access Control](https:\u002F\u002Fowasp.org\u002FTop10\u002F2025\u002F) · [ASVS 5.0 V8 Authorization](https:\u002F\u002Fgithub.com\u002FOWASP\u002FASVS\u002Ftree\u002Fmaster\u002F5.0\u002Fen)\n",{"name":5,"source":24,"category":25,"tech_stack":26,"description":7},"original; cloudflare\u002Fsecurity-audit-skill (MIT) access-control questions (parallel paths, per-item bulk checks, body overrides), adapted; informed by trailofbits\u002Fskills (CC BY-SA 4.0, ideas only, own wording); OWASP API Security Top 10 2023, OWASP Top 10:2025 and ASVS 5.0 cited by name only","security","Web & API","main","910394a0b6db9fc8c9a8f36328ec421d3ebd8b38","catalog\u002Fagents\u002Fsecurity-agent\u002Fskills\u002Faccess-control-and-idor",18,"https:\u002F\u002Fgithub.com\u002Fmakifbaysal\u002Ftasktrooper","https:\u002F\u002Ftasktrooper.ai","https:\u002F\u002Fgithub.com\u002Fmakifbaysal","Senior Software Developer","2026-11-15 04:50:29",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add makifbaysal\u002Ftasktrooper --skill access-control-and-idor",{"tool":42,"command":43},"bunx","bunx skills add makifbaysal\u002Ftasktrooper --skill access-control-and-idor",{"tool":45,"command":46},"pnpm","pnpm dlx skills add makifbaysal\u002Ftasktrooper --skill access-control-and-idor","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmakifbaysal\u002Ftasktrooper\u002Fblob\u002Fmain\u002Fcatalog\u002Fagents\u002Fsecurity-agent\u002Fskills\u002Faccess-control-and-idor\u002FSKILL.md",true,[],[51,57,64,71,78,85],{"skillNo":52,"name":53,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":54,"categories":55,"keywords":56,"publishedAt":19},"01M7CSVEPQW6J6TD6CS2T5FPNZ","visual-craft","https:\u002F\u002Fgithub.com\u002Fmakifbaysal\u002Ftasktrooper\u002Fblob\u002Fmain\u002Fcatalog\u002Fagents\u002Fui-designer\u002Fskills\u002Fvisual-craft\u002FSKILL.md",[],[],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":19},"01M7CSVAQG91ETHQ0HBNZDG5FR","ux-copy","Use when you write any words a user reads in a mockup or a hand-off - content language and voice, buttons, labels, errors, empty states, confirmations, numbers and dates, and the longest-string check","https:\u002F\u002Fgithub.com\u002Fmakifbaysal\u002Ftasktrooper\u002Fblob\u002Fmain\u002Fcatalog\u002Fagents\u002Fui-designer\u002Fskills\u002Fux-copy\u002FSKILL.md",[],[],{"skillNo":65,"name":66,"nameZh":6,"description":67,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":19},"01M7CSV6H0J38659NDXHJQ8396","screen-mockup-html","Use when you draw screens as the design task's HTML mockup - ONE canvas document holding every screen and every variant side by side, the sanitizer-safe recipe, phone and wide frames, the states grid, static control states, and the loopback self-check with screenshots at 375, 768 and 1440 attached to the task","https:\u002F\u002Fgithub.com\u002Fmakifbaysal\u002Ftasktrooper\u002Fblob\u002Fmain\u002Fcatalog\u002Fagents\u002Fui-designer\u002Fskills\u002Fscreen-mockup-html\u002FSKILL.md",[],[],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":77,"publishedAt":19},"01M7CSV3JFRF3BM3XK52M7YEYR","performance-awareness","How the performance score moves for your role. Use when the score context shows a declining trend, or before handing off work you have not self-checked against every criterion.","https:\u002F\u002Fgithub.com\u002Fmakifbaysal\u002Ftasktrooper\u002Fblob\u002Fmain\u002Fcatalog\u002Fagents\u002Fui-designer\u002Fskills\u002Fperformance-awareness\u002FSKILL.md",[],[],{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":19},"01M7CSTZDH00YRF5SCT7BRT9QD","design-variants","Use when a screen design needs variants - how many, variants as side-by-side rows on the one canvas, what makes two variants genuinely different, recommending one, how the human's choice is read, and narrowing to the chosen one in revision","https:\u002F\u002Fgithub.com\u002Fmakifbaysal\u002Ftasktrooper\u002Fblob\u002Fmain\u002Fcatalog\u002Fagents\u002Fui-designer\u002Fskills\u002Fdesign-variants\u002FSKILL.md",[],[],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":19},"01M7CSTV6P3SM3PAE28DB0RF77","design-system-authoring","Use when you derive, change or extend a design system - where tokens live per stack, the DTCG token tree, role-based names for both themes, base vs layer vs drift, the DESIGN.md section order, the inventory format, the contrast check and the lint every proposal returns","https:\u002F\u002Fgithub.com\u002Fmakifbaysal\u002Ftasktrooper\u002Fblob\u002Fmain\u002Fcatalog\u002Fagents\u002Fui-designer\u002Fskills\u002Fdesign-system-authoring\u002FSKILL.md",[],[]]