[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7CSRTBZ704NJ3QGPDQZ1KT5":3,"skill-same:01M7CSRTBZ704NJ3QGPDQZ1KT5":48},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":26,"commitSha":27,"skillDirectory":28,"forksCount":14,"repositoryHtmlUrl":29,"repositoryHomepageUrl":6,"ownerHtmlUrl":30,"ownerBlogUrl":31,"ownerDescription":32,"updatedAt":33,"install":34,"resources":47},"01M7CSRTBZ704NJ3QGPDQZ1KT5","springboot-security",null,"Spring Security best practices for authn\u002Fauthz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.","Henrique1601\u002FSkiilsToIAs","Henrique1601","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F92006691?v=4","01M7CRXVT0GVXVK80JT1GR687S","Henrique Bezerra Dos Santos","01M7CRXVTN5Y8TMWJ1MDSKCQ1T",0,"MIT","https:\u002F\u002Fgithub.com\u002FHenrique1601\u002FSkiilsToIAs\u002Fblob\u002Fmain\u002Fbackend-database\u002Fspringboot-security\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: springboot-security\ndescription: Spring Security best practices for authn\u002Fauthz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.\nmetadata:\n  origin: ECC\n---\n\n# Spring Boot Security Review\n\nUse when adding auth, handling input, creating endpoints, or dealing with secrets.\n\n## When to Activate\n\n- Adding authentication (JWT, OAuth2, session-based)\n- Implementing authorization (@PreAuthorize, role-based access)\n- Validating user input (Bean Validation, custom validators)\n- Configuring CORS, CSRF, or security headers\n- Managing secrets (Vault, environment variables)\n- Adding rate limiting or brute-force protection\n- Scanning dependencies for CVEs\n\n## Authentication\n\n- Prefer stateless JWT or opaque tokens with revocation list\n- Use `httpOnly`, `Secure`, `SameSite=Strict` cookies for sessions\n- Validate tokens with `OncePerRequestFilter` or resource server\n\n```java\n@Component\npublic class JwtAuthFilter extends OncePerRequestFilter {\n  private final JwtService jwtService;\n\n  public JwtAuthFilter(JwtService jwtService) {\n    this.jwtService = jwtService;\n  }\n\n  @Override\n  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,\n      FilterChain chain) throws ServletException, IOException {\n    String header = request.getHeader(HttpHeaders.AUTHORIZATION);\n    if (header != null && header.startsWith(\"Bearer \")) {\n      String token = header.substring(7);\n      Authentication auth = jwtService.authenticate(token);\n      SecurityContextHolder.getContext().setAuthentication(auth);\n    }\n    chain.doFilter(request, response);\n  }\n}\n```\n\n## Authorization\n\n- Enable method security: `@EnableMethodSecurity`\n- Use `@PreAuthorize(\"hasRole('ADMIN')\")` or `@PreAuthorize(\"@authz.canEdit(#id)\")`\n- Deny by default; expose only required scopes\n\n```java\n@RestController\n@RequestMapping(\"\u002Fapi\u002Fadmin\")\npublic class AdminController {\n\n  @PreAuthorize(\"hasRole('ADMIN')\")\n  @GetMapping(\"\u002Fusers\")\n  public List\u003CUserDto> listUsers() {\n    return userService.findAll();\n  }\n\n  @PreAuthorize(\"@authz.isOwner(#id, authentication)\")\n  @DeleteMapping(\"\u002Fusers\u002F{id}\")\n  public ResponseEntity\u003CVoid> deleteUser(@PathVariable Long id) {\n    userService.delete(id);\n    return ResponseEntity.noContent().build();\n  }\n}\n```\n\n## Input Validation\n\n- Use Bean Validation with `@Valid` on controllers\n- Apply constraints on DTOs: `@NotBlank`, `@Email`, `@Size`, custom validators\n- Sanitize any HTML with a whitelist before rendering\n\n```java\n\u002F\u002F BAD: No validation\n@PostMapping(\"\u002Fusers\")\npublic User createUser(@RequestBody UserDto dto) {\n  return userService.create(dto);\n}\n\n\u002F\u002F GOOD: Validated DTO\npublic record CreateUserDto(\n    @NotBlank @Size(max = 100) String name,\n    @NotBlank @Email String email,\n    @NotNull @Min(0) @Max(150) Integer age\n) {}\n\n@PostMapping(\"\u002Fusers\")\npublic ResponseEntity\u003CUserDto> createUser(@Valid @RequestBody CreateUserDto dto) {\n  return ResponseEntity.status(HttpStatus.CREATED)\n      .body(userService.create(dto));\n}\n```\n\n## SQL Injection Prevention\n\n- Use Spring Data repositories or parameterized queries\n- For native queries, use `:param` bindings; never concatenate strings\n\n```java\n\u002F\u002F BAD: String concatenation in native query\n@Query(value = \"SELECT * FROM users WHERE name = '\" + name + \"'\", nativeQuery = true)\n\n\u002F\u002F GOOD: Parameterized native query\n@Query(value = \"SELECT * FROM users WHERE name = :name\", nativeQuery = true)\nList\u003CUser> findByName(@Param(\"name\") String name);\n\n\u002F\u002F GOOD: Spring Data derived query (auto-parameterized)\nList\u003CUser> findByEmailAndActiveTrue(String email);\n```\n\n## Password Encoding\n\n- Always hash passwords with BCrypt or Argon2 — never store plaintext\n- Use `PasswordEncoder` bean, not manual hashing\n\n```java\n@Bean\npublic PasswordEncoder passwordEncoder() {\n  return new BCryptPasswordEncoder(12); \u002F\u002F cost factor 12\n}\n\n\u002F\u002F In service\npublic User register(CreateUserDto dto) {\n  String hashedPassword = passwordEncoder.encode(dto.password());\n  return userRepository.save(new User(dto.email(), hashedPassword));\n}\n```\n\n## CSRF Protection\n\n- For browser session apps, keep CSRF enabled; include token in forms\u002Fheaders\n- For pure APIs with Bearer tokens, disable CSRF and rely on stateless auth\n\n```java\nhttp\n  .csrf(csrf -> csrf.disable())\n  .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));\n```\n\n## Secrets Management\n\n- No secrets in source; load from env or vault\n- Keep `application.yml` free of credentials; use placeholders\n- Rotate tokens and DB credentials regularly\n\n```yaml\n# BAD: Hardcoded in application.yml\nspring:\n  datasource:\n    password: mySecretPassword123\n\n# GOOD: Environment variable placeholder\nspring:\n  datasource:\n    password: ${DB_PASSWORD}\n\n# GOOD: Spring Cloud Vault integration\nspring:\n  cloud:\n    vault:\n      uri: https:\u002F\u002Fvault.example.com\n      token: ${VAULT_TOKEN}\n```\n\n## Security Headers\n\n```java\nhttp\n  .headers(headers -> headers\n    .contentSecurityPolicy(csp -> csp\n      .policyDirectives(\"default-src 'self'\"))\n    .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)\n    .xssProtection(Customizer.withDefaults())\n    .referrerPolicy(rp -> rp.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.NO_REFERRER)));\n```\n\n## CORS Configuration\n\n- Configure CORS at the security filter level, not per-controller\n- Restrict allowed origins — never use `*` in production\n\n```java\n@Bean\npublic CorsConfigurationSource corsConfigurationSource() {\n  CorsConfiguration config = new CorsConfiguration();\n  config.setAllowedOrigins(List.of(\"https:\u002F\u002Fapp.example.com\"));\n  config.setAllowedMethods(List.of(\"GET\", \"POST\", \"PUT\", \"DELETE\"));\n  config.setAllowedHeaders(List.of(\"Authorization\", \"Content-Type\"));\n  config.setAllowCredentials(true);\n  config.setMaxAge(3600L);\n\n  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();\n  source.registerCorsConfiguration(\"\u002Fapi\u002F**\", config);\n  return source;\n}\n\n\u002F\u002F In SecurityFilterChain:\nhttp.cors(cors -> cors.configurationSource(corsConfigurationSource()));\n```\n\n## Rate Limiting\n\n- Apply Bucket4j or gateway-level limits on expensive endpoints\n- Log and alert on bursts; return 429 with retry hints\n\n```java\n\u002F\u002F Using Bucket4j for per-endpoint rate limiting\n@Component\npublic class RateLimitFilter extends OncePerRequestFilter {\n  private final Map\u003CString, Bucket> buckets = new ConcurrentHashMap\u003C>();\n\n  private Bucket createBucket() {\n    return Bucket.builder()\n        .addLimit(Bandwidth.classic(100, Refill.intervally(100, Duration.ofMinutes(1))))\n        .build();\n  }\n\n  @Override\n  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,\n      FilterChain chain) throws ServletException, IOException {\n    String clientIp = request.getRemoteAddr();\n    Bucket bucket = buckets.computeIfAbsent(clientIp, k -> createBucket());\n\n    if (bucket.tryConsume(1)) {\n      chain.doFilter(request, response);\n    } else {\n      response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());\n      response.getWriter().write(\"{\\\"error\\\": \\\"Rate limit exceeded\\\"}\");\n    }\n  }\n}\n```\n\n## Dependency Security\n\n- Run OWASP Dependency Check \u002F Snyk in CI\n- Keep Spring Boot and Spring Security on supported versions\n- Fail builds on known CVEs\n\n## Logging and PII\n\n- Never log secrets, tokens, passwords, or full PAN data\n- Redact sensitive fields; use structured JSON logging\n\n## File Uploads\n\n- Validate size, content type, and extension\n- Store outside web root; scan if required\n\n## Checklist Before Release\n\n- [ ] Auth tokens validated and expired correctly\n- [ ] Authorization guards on every sensitive path\n- [ ] All inputs validated and sanitized\n- [ ] No string-concatenated SQL\n- [ ] CSRF posture correct for app type\n- [ ] Secrets externalized; none committed\n- [ ] Security headers configured\n- [ ] Rate limiting on APIs\n- [ ] Dependencies scanned and up to date\n- [ ] Logs free of sensitive data\n\n**Remember**: Deny by default, validate inputs, least privilege, and secure-by-configuration first.\n","# Spring Boot Security Review\n\nUse when adding auth, handling input, creating endpoints, or dealing with secrets.\n\n## When to Activate\n\n- Adding authentication (JWT, OAuth2, session-based)\n- Implementing authorization (@PreAuthorize, role-based access)\n- Validating user input (Bean Validation, custom validators)\n- Configuring CORS, CSRF, or security headers\n- Managing secrets (Vault, environment variables)\n- Adding rate limiting or brute-force protection\n- Scanning dependencies for CVEs\n\n## Authentication\n\n- Prefer stateless JWT or opaque tokens with revocation list\n- Use `httpOnly`, `Secure`, `SameSite=Strict` cookies for sessions\n- Validate tokens with `OncePerRequestFilter` or resource server\n\n```java\n@Component\npublic class JwtAuthFilter extends OncePerRequestFilter {\n  private final JwtService jwtService;\n\n  public JwtAuthFilter(JwtService jwtService) {\n    this.jwtService = jwtService;\n  }\n\n  @Override\n  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,\n      FilterChain chain) throws ServletException, IOException {\n    String header = request.getHeader(HttpHeaders.AUTHORIZATION);\n    if (header != null && header.startsWith(\"Bearer \")) {\n      String token = header.substring(7);\n      Authentication auth = jwtService.authenticate(token);\n      SecurityContextHolder.getContext().setAuthentication(auth);\n    }\n    chain.doFilter(request, response);\n  }\n}\n```\n\n## Authorization\n\n- Enable method security: `@EnableMethodSecurity`\n- Use `@PreAuthorize(\"hasRole('ADMIN')\")` or `@PreAuthorize(\"@authz.canEdit(#id)\")`\n- Deny by default; expose only required scopes\n\n```java\n@RestController\n@RequestMapping(\"\u002Fapi\u002Fadmin\")\npublic class AdminController {\n\n  @PreAuthorize(\"hasRole('ADMIN')\")\n  @GetMapping(\"\u002Fusers\")\n  public List\u003CUserDto> listUsers() {\n    return userService.findAll();\n  }\n\n  @PreAuthorize(\"@authz.isOwner(#id, authentication)\")\n  @DeleteMapping(\"\u002Fusers\u002F{id}\")\n  public ResponseEntity\u003CVoid> deleteUser(@PathVariable Long id) {\n    userService.delete(id);\n    return ResponseEntity.noContent().build();\n  }\n}\n```\n\n## Input Validation\n\n- Use Bean Validation with `@Valid` on controllers\n- Apply constraints on DTOs: `@NotBlank`, `@Email`, `@Size`, custom validators\n- Sanitize any HTML with a whitelist before rendering\n\n```java\n\u002F\u002F BAD: No validation\n@PostMapping(\"\u002Fusers\")\npublic User createUser(@RequestBody UserDto dto) {\n  return userService.create(dto);\n}\n\n\u002F\u002F GOOD: Validated DTO\npublic record CreateUserDto(\n    @NotBlank @Size(max = 100) String name,\n    @NotBlank @Email String email,\n    @NotNull @Min(0) @Max(150) Integer age\n) {}\n\n@PostMapping(\"\u002Fusers\")\npublic ResponseEntity\u003CUserDto> createUser(@Valid @RequestBody CreateUserDto dto) {\n  return ResponseEntity.status(HttpStatus.CREATED)\n      .body(userService.create(dto));\n}\n```\n\n## SQL Injection Prevention\n\n- Use Spring Data repositories or parameterized queries\n- For native queries, use `:param` bindings; never concatenate strings\n\n```java\n\u002F\u002F BAD: String concatenation in native query\n@Query(value = \"SELECT * FROM users WHERE name = '\" + name + \"'\", nativeQuery = true)\n\n\u002F\u002F GOOD: Parameterized native query\n@Query(value = \"SELECT * FROM users WHERE name = :name\", nativeQuery = true)\nList\u003CUser> findByName(@Param(\"name\") String name);\n\n\u002F\u002F GOOD: Spring Data derived query (auto-parameterized)\nList\u003CUser> findByEmailAndActiveTrue(String email);\n```\n\n## Password Encoding\n\n- Always hash passwords with BCrypt or Argon2 — never store plaintext\n- Use `PasswordEncoder` bean, not manual hashing\n\n```java\n@Bean\npublic PasswordEncoder passwordEncoder() {\n  return new BCryptPasswordEncoder(12); \u002F\u002F cost factor 12\n}\n\n\u002F\u002F In service\npublic User register(CreateUserDto dto) {\n  String hashedPassword = passwordEncoder.encode(dto.password());\n  return userRepository.save(new User(dto.email(), hashedPassword));\n}\n```\n\n## CSRF Protection\n\n- For browser session apps, keep CSRF enabled; include token in forms\u002Fheaders\n- For pure APIs with Bearer tokens, disable CSRF and rely on stateless auth\n\n```java\nhttp\n  .csrf(csrf -> csrf.disable())\n  .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));\n```\n\n## Secrets Management\n\n- No secrets in source; load from env or vault\n- Keep `application.yml` free of credentials; use placeholders\n- Rotate tokens and DB credentials regularly\n\n```yaml\n# BAD: Hardcoded in application.yml\nspring:\n  datasource:\n    password: mySecretPassword123\n\n# GOOD: Environment variable placeholder\nspring:\n  datasource:\n    password: ${DB_PASSWORD}\n\n# GOOD: Spring Cloud Vault integration\nspring:\n  cloud:\n    vault:\n      uri: https:\u002F\u002Fvault.example.com\n      token: ${VAULT_TOKEN}\n```\n\n## Security Headers\n\n```java\nhttp\n  .headers(headers -> headers\n    .contentSecurityPolicy(csp -> csp\n      .policyDirectives(\"default-src 'self'\"))\n    .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)\n    .xssProtection(Customizer.withDefaults())\n    .referrerPolicy(rp -> rp.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.NO_REFERRER)));\n```\n\n## CORS Configuration\n\n- Configure CORS at the security filter level, not per-controller\n- Restrict allowed origins — never use `*` in production\n\n```java\n@Bean\npublic CorsConfigurationSource corsConfigurationSource() {\n  CorsConfiguration config = new CorsConfiguration();\n  config.setAllowedOrigins(List.of(\"https:\u002F\u002Fapp.example.com\"));\n  config.setAllowedMethods(List.of(\"GET\", \"POST\", \"PUT\", \"DELETE\"));\n  config.setAllowedHeaders(List.of(\"Authorization\", \"Content-Type\"));\n  config.setAllowCredentials(true);\n  config.setMaxAge(3600L);\n\n  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();\n  source.registerCorsConfiguration(\"\u002Fapi\u002F**\", config);\n  return source;\n}\n\n\u002F\u002F In SecurityFilterChain:\nhttp.cors(cors -> cors.configurationSource(corsConfigurationSource()));\n```\n\n## Rate Limiting\n\n- Apply Bucket4j or gateway-level limits on expensive endpoints\n- Log and alert on bursts; return 429 with retry hints\n\n```java\n\u002F\u002F Using Bucket4j for per-endpoint rate limiting\n@Component\npublic class RateLimitFilter extends OncePerRequestFilter {\n  private final Map\u003CString, Bucket> buckets = new ConcurrentHashMap\u003C>();\n\n  private Bucket createBucket() {\n    return Bucket.builder()\n        .addLimit(Bandwidth.classic(100, Refill.intervally(100, Duration.ofMinutes(1))))\n        .build();\n  }\n\n  @Override\n  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,\n      FilterChain chain) throws ServletException, IOException {\n    String clientIp = request.getRemoteAddr();\n    Bucket bucket = buckets.computeIfAbsent(clientIp, k -> createBucket());\n\n    if (bucket.tryConsume(1)) {\n      chain.doFilter(request, response);\n    } else {\n      response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());\n      response.getWriter().write(\"{\\\"error\\\": \\\"Rate limit exceeded\\\"}\");\n    }\n  }\n}\n```\n\n## Dependency Security\n\n- Run OWASP Dependency Check \u002F Snyk in CI\n- Keep Spring Boot and Spring Security on supported versions\n- Fail builds on known CVEs\n\n## Logging and PII\n\n- Never log secrets, tokens, passwords, or full PAN data\n- Redact sensitive fields; use structured JSON logging\n\n## File Uploads\n\n- Validate size, content type, and extension\n- Store outside web root; scan if required\n\n## Checklist Before Release\n\n- [ ] Auth tokens validated and expired correctly\n- [ ] Authorization guards on every sensitive path\n- [ ] All inputs validated and sanitized\n- [ ] No string-concatenated SQL\n- [ ] CSRF posture correct for app type\n- [ ] Secrets externalized; none committed\n- [ ] Security headers configured\n- [ ] Rate limiting on APIs\n- [ ] Dependencies scanned and up to date\n- [ ] Logs free of sensitive data\n\n**Remember**: Deny by default, validate inputs, least privilege, and secure-by-configuration first.\n",{"name":5,"metadata":24,"description":7},{"origin":25},"ECC","main","a73152352c0612252131e5cf84e91312a6cf17dc","backend-database\u002Fspringboot-security","https:\u002F\u002Fgithub.com\u002FHenrique1601\u002FSkiilsToIAs","https:\u002F\u002Fgithub.com\u002FHenrique1601","https:\u002F\u002Fbezerraportifolio.netlify.app\u002F","Full Stack Developer | React, Next.js, TypeScript, Node.js & IA | Construindo produtos digitais e soluções SaaS","2026-11-15 02:56:04",{"source":8,"skillName":5,"commands":35,"prompt":45,"zipAvailable":46},[36,39,42],{"tool":37,"command":38},"npx","npx skills add Henrique1601\u002FSkiilsToIAs --skill springboot-security",{"tool":40,"command":41},"bunx","bunx skills add Henrique1601\u002FSkiilsToIAs --skill springboot-security",{"tool":43,"command":44},"pnpm","pnpm dlx skills add Henrique1601\u002FSkiilsToIAs --skill springboot-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenrique1601\u002FSkiilsToIAs\u002Fblob\u002Fmain\u002Fbackend-database\u002Fspringboot-security\u002FSKILL.md",true,[],[49,56,63,71,78,85],{"skillNo":50,"name":51,"nameZh":6,"description":52,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":53,"categories":54,"keywords":55,"publishedAt":19},"01M7E2ANBW9V6AVX5JXNCEAWF8","rag-architect-agent","Agente Arquiteto de RAG, Embeddings & Busca Vetorial. Especialista em design e implementação de pipelines de Retrieval-Augmented Generation de alta fidelidade: chunking semântico, modelagem pgvector no PostgreSQL (Neon\u002FSupabase), busca híbrida (cosseno + BM25), reranking, validação via TypeSafe AI e filosofia Ponytail (anti-overengineering).","https:\u002F\u002Fgithub.com\u002FHenrique1601\u002FSkiilsToIAs\u002Fblob\u002Fmain\u002Fcustom-agents\u002Frag-architect-agent\u002FSKILL.md",[],[],{"skillNo":57,"name":58,"nameZh":6,"description":59,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":60,"categories":61,"keywords":62,"publishedAt":19},"01M7E29KKF8R02ZRGYE2MJM67G","rag-architecture-patterns","Padrões arquiteturais e implementação de pipelines RAG (Retrieval-Augmented Generation) de alta fidelidade para qualquer projeto ou sistema. Cobre chunking semântico, embeddings, busca híbrida (pgvector + BM25), reranking, validação via TypeSafe AI e filosofia Ponytail (anti-overengineering).","https:\u002F\u002Fgithub.com\u002FHenrique1601\u002FSkiilsToIAs\u002Fblob\u002Fmain\u002Fai-agents\u002Frag-architecture-patterns\u002FSKILL.md",[],[],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":67,"licenseFileUrl":6,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":19},"01M7CWRA8E3BJ7CPY8N8EG28J1","skill-repair","Use this to fix and re-install agent skills that have failed installation.\nThis skill provides the necessary context and permissions to surgically update\nthe `manifest.json` after a fix has been applied.","Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenrique1601\u002FSkiilsToIAs\u002Fblob\u002Fmain\u002Futilities\u002Fskill-repair\u002FSKILL.md",[],[],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":77,"publishedAt":19},"01M7CWR66FZP8FA47WVZ4Z2EXC","security-scan","Scan your Claude Code configuration (.claude\u002F directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.","https:\u002F\u002Fgithub.com\u002FHenrique1601\u002FSkiilsToIAs\u002Fblob\u002Fmain\u002Futilities\u002Fsecurity-scan\u002FSKILL.md",[],[],{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":19},"01M7CWR0QPY58QPTR1P759TFNG","security-review","Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment\u002Fsensitive features. Provides comprehensive security checklist and patterns.","https:\u002F\u002Fgithub.com\u002FHenrique1601\u002FSkiilsToIAs\u002Fblob\u002Fmain\u002Futilities\u002Fsecurity-review\u002FSKILL.md",[],[],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":19},"01M7CWQXCE40XWT4FZ3VWZFGDP","security-bounty-hunter","Hunt for exploitable, bounty-worthy security issues in repositories. Focuses on remotely reachable vulnerabilities that qualify for real reports instead of noisy local-only findings.","https:\u002F\u002Fgithub.com\u002FHenrique1601\u002FSkiilsToIAs\u002Fblob\u002Fmain\u002Futilities\u002Fsecurity-bounty-hunter\u002FSKILL.md",[],[]]