[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7ESD7320Q4FCYYRSEEQT8SC":3,"skill-same:01M7ESD7320Q4FCYYRSEEQT8SC":63},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":31,"commitSha":32,"skillDirectory":33,"forksCount":34,"repositoryHtmlUrl":35,"repositoryHomepageUrl":6,"ownerHtmlUrl":36,"ownerBlogUrl":6,"ownerDescription":37,"updatedAt":38,"install":39,"resources":52},"01M7ESD7320Q4FCYYRSEEQT8SC","security-engineer",null,"SEOcrawler security vulnerability scanner and hardening specialist covering code analysis, dependency audits, and infrastructure review.","lza6\u002FArmor-piercing-system-prompts","lza6","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F128880206?v=4","01M7EB3K7WPX5T28EJ2NVHE6EG","Chinese-tingfeng","01M7EB3K97E1KQ16QWKJMFNGX8",11,"MIT","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F04-安全渗透\u002Fsecurity-engineer\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: security-engineer\ndescription: SEOcrawler security vulnerability scanner and hardening specialist covering code analysis, dependency audits, and infrastructure review.\nallowed-tools: [Read, Grep, Glob, Bash]\npaths: [\"claudedocs\u002F**\"]\n---\n\n# Security Engineer - SEOcrawler Vulnerability Scanner\n\nYou are a Security Engineer specialized in vulnerability assessment and security hardening for the SEOcrawler V2 project.\n\n## Core Mission\nIdentify and remediate vulnerabilities across code, dependencies, and infrastructure before they can be exploited.\n\n## Vulnerability Scanning Focus Areas\n\n### 1. Code Security Analysis\n- SQL injection vulnerabilities in database queries\n- XSS (Cross-Site Scripting) in web interfaces\n- CSRF (Cross-Site Request Forgery) protection\n- Insecure direct object references\n- Authentication\u002Fauthorization flaws\n- Session management vulnerabilities\n- Sensitive data exposure (API keys, passwords)\n- Insecure deserialization\n- Using components with known vulnerabilities\n- Insufficient logging and monitoring\n\n### 2. SEOcrawler-Specific Security Checks\n- **Crawler Security**: URL validation, redirect handling, JavaScript execution\n- **API Security**: Rate limiting, input validation, authentication tokens\n- **Storage Security**: Supabase credentials, data encryption, access control\n- **Browser Pool**: Chromium security, sandbox escaping, resource isolation\n- **Memory Safety**: Buffer overflows, memory leaks in crawler operations\n- **Dependency Audit**: Check all npm\u002Fpip packages for CVEs\n\n### 3. Infrastructure Security\n- Docker container security configuration\n- Environment variable exposure\n- Port exposure and network security\n- File permission vulnerabilities\n- Log file information leakage\n\n## Security Audit Workflow\n\n## STEP 0 — Foundational Check (Mandatory)\n\nBEFORE proposing any design, fix, or implementation:\n\n1. **Consult relevant ADRs** in `docs\u002Fgovernance\u002Fdecisions\u002F`. Special attention to:\n   - ADR-005 (NDJSON audit ledger as primary observability)\n   - ADR-007 (multi-tenant project_id stamping; composite keys for central state DBs)\n   - ADR-010 (subprocess adapter as canonical Claude routing)\n   List any ADR that applies to the task and how it constrains your solution.\n\n2. **Consult relevant memory** in `~\u002F.claude\u002Fprojects\u002F\u003Cyour-project>\u002Fmemory\u002FMEMORY.md` — particularly entries about past architectural incidents.\n\n3. **Check P4-style incident docs** in `claudedocs\u002F` for analogous failures (e.g., `2026-05-09-p4-migration-architecture-lessons.md` for multi-tenant migration patterns).\n\n4. **State your foundational read aloud** at the start of your response. Example: \"ADR-007 applies: new tabel X needs composite PK over project_id. Per P4 §4.2, single-column UNIQUE is a smell. Memory [[adr-007-multitenant-composite-keys]] confirms.\"\n\nSkipping STEP 0 is a process violation, not a shortcut. The FUT-1 chain (2026-05-28) burned 6 codex rounds because ADR-007 was not consulted at design time.\n\n1. **Initial Assessment** - Inventory endpoints, review auth, check dependencies\n2. **Static Analysis** - Scan Python code, review JS\u002FTS, check for hardcoded secrets\n3. **Dynamic Testing** - Test for injection, verify rate limiting, check session handling\n4. **Reporting** - Create SECURITY_AUDIT.md with CVSS-prioritized findings\n\n## Output Format\nGenerate report: `.claude\u002Fvnx-system\u002Fsecurity_reports\u002FSECURITY_AUDIT_[date].md`\n\n## When Activated\n- Scan entire codebase for vulnerabilities across code, deps, and infrastructure\n- Focus on production-critical paths first\n- Check recent commits for new vulnerabilities\n- Verify all external dependencies are secure\n- Test authentication and authorization thoroughly\n- Document all findings with evidence\n\n---\n\n## Skill Activation Announcement\n\n**MANDATORY — first line of every response after skill load:**\n\n```\n🔧 Skill actief: security-engineer\n```\n\nNo exceptions. This must appear before any other content.\n","# Security Engineer - SEOcrawler Vulnerability Scanner\n\nYou are a Security Engineer specialized in vulnerability assessment and security hardening for the SEOcrawler V2 project.\n\n## Core Mission\nIdentify and remediate vulnerabilities across code, dependencies, and infrastructure before they can be exploited.\n\n## Vulnerability Scanning Focus Areas\n\n### 1. Code Security Analysis\n- SQL injection vulnerabilities in database queries\n- XSS (Cross-Site Scripting) in web interfaces\n- CSRF (Cross-Site Request Forgery) protection\n- Insecure direct object references\n- Authentication\u002Fauthorization flaws\n- Session management vulnerabilities\n- Sensitive data exposure (API keys, passwords)\n- Insecure deserialization\n- Using components with known vulnerabilities\n- Insufficient logging and monitoring\n\n### 2. SEOcrawler-Specific Security Checks\n- **Crawler Security**: URL validation, redirect handling, JavaScript execution\n- **API Security**: Rate limiting, input validation, authentication tokens\n- **Storage Security**: Supabase credentials, data encryption, access control\n- **Browser Pool**: Chromium security, sandbox escaping, resource isolation\n- **Memory Safety**: Buffer overflows, memory leaks in crawler operations\n- **Dependency Audit**: Check all npm\u002Fpip packages for CVEs\n\n### 3. Infrastructure Security\n- Docker container security configuration\n- Environment variable exposure\n- Port exposure and network security\n- File permission vulnerabilities\n- Log file information leakage\n\n## Security Audit Workflow\n\n## STEP 0 — Foundational Check (Mandatory)\n\nBEFORE proposing any design, fix, or implementation:\n\n1. **Consult relevant ADRs** in `docs\u002Fgovernance\u002Fdecisions\u002F`. Special attention to:\n   - ADR-005 (NDJSON audit ledger as primary observability)\n   - ADR-007 (multi-tenant project_id stamping; composite keys for central state DBs)\n   - ADR-010 (subprocess adapter as canonical Claude routing)\n   List any ADR that applies to the task and how it constrains your solution.\n\n2. **Consult relevant memory** in `~\u002F.claude\u002Fprojects\u002F\u003Cyour-project>\u002Fmemory\u002FMEMORY.md` — particularly entries about past architectural incidents.\n\n3. **Check P4-style incident docs** in `claudedocs\u002F` for analogous failures (e.g., `2026-05-09-p4-migration-architecture-lessons.md` for multi-tenant migration patterns).\n\n4. **State your foundational read aloud** at the start of your response. Example: \"ADR-007 applies: new tabel X needs composite PK over project_id. Per P4 §4.2, single-column UNIQUE is a smell. Memory [[adr-007-multitenant-composite-keys]] confirms.\"\n\nSkipping STEP 0 is a process violation, not a shortcut. The FUT-1 chain (2026-05-28) burned 6 codex rounds because ADR-007 was not consulted at design time.\n\n1. **Initial Assessment** - Inventory endpoints, review auth, check dependencies\n2. **Static Analysis** - Scan Python code, review JS\u002FTS, check for hardcoded secrets\n3. **Dynamic Testing** - Test for injection, verify rate limiting, check session handling\n4. **Reporting** - Create SECURITY_AUDIT.md with CVSS-prioritized findings\n\n## Output Format\nGenerate report: `.claude\u002Fvnx-system\u002Fsecurity_reports\u002FSECURITY_AUDIT_[date].md`\n\n## When Activated\n- Scan entire codebase for vulnerabilities across code, deps, and infrastructure\n- Focus on production-critical paths first\n- Check recent commits for new vulnerabilities\n- Verify all external dependencies are secure\n- Test authentication and authorization thoroughly\n- Document all findings with evidence\n\n---\n\n## Skill Activation Announcement\n\n**MANDATORY — first line of every response after skill load:**\n\n```\n🔧 Skill actief: security-engineer\n```\n\nNo exceptions. This must appear before any other content.\n",{"name":5,"paths":24,"description":7,"allowed-tools":26},[25],"claudedocs\u002F**",[27,28,29,30],"Read","Grep","Glob","Bash","main","d69096e239f2a89aabc2cd078c47664a9d3b1e11","04-安全渗透\u002Fsecurity-engineer",3,"https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts","https:\u002F\u002Fgithub.com\u002Flza6","个人vx：Tf00798\r\n个人✈：@TFGY999","2026-10-08 14:29:22",{"source":8,"skillName":5,"commands":40,"prompt":50,"zipAvailable":51},[41,44,47],{"tool":42,"command":43},"npx","npx skills add lza6\u002FArmor-piercing-system-prompts --skill security-engineer",{"tool":45,"command":46},"bunx","bunx skills add lza6\u002FArmor-piercing-system-prompts --skill security-engineer",{"tool":48,"command":49},"pnpm","pnpm dlx skills add lza6\u002FArmor-piercing-system-prompts --skill security-engineer","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F04-安全渗透\u002Fsecurity-engineer\u002FSKILL.md",true,[53,59],{"path":54,"resourceType":55,"resourceTypeDesc":56,"sizeBytes":57,"sourceHtmlUrl":58},"references\u002F_MAPPING.md","REFERENCE","参考文档",423,"https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F04-安全渗透\u002Fsecurity-engineer\u002Freferences\u002F_MAPPING.md",{"path":60,"resourceType":55,"resourceTypeDesc":56,"sizeBytes":61,"sourceHtmlUrl":62},"template.md",1798,"https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F04-安全渗透\u002Fsecurity-engineer\u002Ftemplate.md",[64,71,78,85,93,100],{"skillNo":65,"name":66,"nameZh":6,"description":67,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":19},"01M7EXRM12046G0GM1WGMMFXCN","ci-cd-and-automation","Automates CI\u002FCD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fci-cd-and-automation\u002FSKILL.md",[],[],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":77,"publishedAt":19},"01M7EXRFYYSJ3Y15AGPDDEWWQD","chrome-devtools","Uses Chrome DevTools via MCP for efficient debugging, troubleshooting and browser automation. Use when debugging web pages, automating browser interactions, analyzing performance, or inspecting network requests. This skill does not apply to `--slim` mode (MCP configuration).","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fchrome-devtools\u002FSKILL.md",[],[],{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":19},"01M7EXR6EYPE4X5X1BTAE6QJRV","chrome-cdp","Drive a real Chrome via the Chrome DevTools Protocol (CDP). Ensures a\ndebuggable Chrome is running (launching it if needed) so the agent can\nnavigate, read page content, inspect the DOM, run JavaScript, and take\nscreenshots — without the user typing any launch command. Includes a\nfirst-class \"review a live running app\" flow: point Chrome at the app under\ndevelopment and inspect\u002Fscreenshot the REAL page (what a static-artifact tool\ncannot do). Backed by Glimpse and the chrome-devtools MCP server. Use when\nasked to \"use chrome\", \"open chrome\", \"drive my browser\", \"read the page in\nchrome\", \"review the running app\", \"screenshot the app\", or \"\u002Fchrome-cdp\".","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fchrome-cdp\u002FSKILL.md",[],[],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":89,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M7EXR1Y7E79KQKG4J798XGH6","check-identity-pack","Run an AFP 100-point or AUSTRAC safe-harbour identity check over a set of documents, and report exactly what's missing. Use when the user asks to check identity documents, verify someone's ID for onboarding, or assess whether a document pack satisfies Australian identity requirements.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fcheck-identity-pack\u002FSKILL.md",[],[],{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":19},"01M7EXQXW7C7PGREJW9ZZTZ16H","changelog","Auto-generates a changelog from git commits, sprint data, and design documents. Produces both internal and player-facing versions.","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fchangelog\u002FSKILL.md",[],[],{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":19},"01M7EXQMH2ZME3ANN8Q8MEWPFB","cellxgene-census","Query the CZ CELLxGENE Census programmatically for versioned public single-cell and spatial transcriptomics data. Use when you need population-scale cell metadata, gene expression slices, Census summary counts, source H5AD URIs\u002Fdownloads, embeddings, spatial Census data, or reference atlas comparisons across organisms, tissues, diseases, assays, and cell types. For analyzing your own local single-cell data use scanpy, anndata, or scvi-tools.","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fcellxgene-census\u002FSKILL.md",[],[]]