[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFTTF3WWJPFAVY7YCZHND5":3,"skill-same:01M6AFTTF3WWJPFAVY7YCZHND5":71},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":52,"ownerHtmlUrl":53,"ownerBlogUrl":54,"ownerDescription":55,"updatedAt":56,"install":57,"resources":70},"01M6AFTTF3WWJPFAVY7YCZHND5","sast-configuration",null,"Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.","davila7\u002Fclaude-code-templates","davila7","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6216945?v=4","01M6ADEWWFPS191NFM0Y1EX1JH","Daniel Avila","01M6ADJHGM78PHQRD3XZTFDVKK",33481,"MIT","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fsast-configuration\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"sast","sast configuration","configuration","2026","testing","static","custom","unknown","for","creation","programming languages","Security Testing","across","security scanning","community","scanning","programming","tool","setup","security","application security","2026-11-10 10:12:30",false,"---\nname: sast-configuration\ndescription: \"Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.\"\nmetadata:\n  risk: unknown\n  source: community\n  date_added: \"2026-02-27\"\n---\n\n# SAST Configuration\n\nStatic Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.\n\n## Use this skill when\n\n- Set up SAST scanning in CI\u002FCD pipelines\n- Create custom security rules for your codebase\n- Configure quality gates and compliance policies\n- Optimize scan performance and reduce false positives\n- Integrate multiple SAST tools for defense-in-depth\n\n## Do not use this skill when\n\n- You only need DAST or manual penetration testing guidance\n- You cannot access source code or CI\u002FCD pipelines\n- You need organizational policy decisions rather than tooling setup\n\n## Instructions\n\n1. Identify languages, repos, and compliance requirements.\n2. Choose tools and define a baseline policy.\n3. Integrate scans into CI\u002FCD with gating thresholds.\n4. Tune rules and suppressions based on false positives.\n5. Track remediation and verify fixes.\n\n## Safety\n\n- Avoid scanning sensitive repos with third-party services without approval.\n- Prevent leaks of secrets in scan artifacts and logs.\n\n## Overview\n\nThis skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL.\n\n## Core Capabilities\n\n### 1. Semgrep Configuration\n- Custom rule creation with pattern matching\n- Language-specific security rules (Python, JavaScript, Go, Java, etc.)\n- CI\u002FCD integration (GitHub Actions, GitLab CI, Jenkins)\n- False positive tuning and rule optimization\n- Organizational policy enforcement\n\n### 2. SonarQube Setup\n- Quality gate configuration\n- Security hotspot analysis\n- Code coverage and technical debt tracking\n- Custom quality profiles for languages\n- Enterprise integration with LDAP\u002FSAML\n\n### 3. CodeQL Analysis\n- GitHub Advanced Security integration\n- Custom query development\n- Vulnerability variant analysis\n- Security research workflows\n- SARIF result processing\n\n## Quick Start\n\n### Initial Assessment\n1. Identify primary programming languages in your codebase\n2. Determine compliance requirements (PCI-DSS, SOC 2, etc.)\n3. Choose SAST tool based on language support and integration needs\n4. Review baseline scan to understand current security posture\n\n### Basic Setup\n```bash\n# Semgrep quick start\npip install semgrep\nsemgrep --config=auto --error\n\n# SonarQube with Docker\ndocker run -d --name sonarqube -p 9000:9000 sonarqube:latest\n\n# CodeQL CLI setup\ngh extension install github\u002Fgh-codeql\ncodeql database create mydb --language=python\n```\n\n## Reference Documentation\n\n- Semgrep Rule Creation - Pattern-based security rule development\n- SonarQube Configuration - Quality gates and profiles\n- CodeQL Setup Guide - Query development and workflows\n\n## Templates & Assets\n\n- semgrep-config.yml - Production-ready Semgrep configuration\n- sonarqube-settings.xml - SonarQube quality profile template\n- run-sast.sh - Automated SAST execution script\n\n## Integration Patterns\n\n### CI\u002FCD Pipeline Integration\n```yaml\n# GitHub Actions example\n- name: Run Semgrep\n  uses: returntocorp\u002Fsemgrep-action@v1\n  with:\n    config: >-\n      p\u002Fsecurity-audit\n      p\u002Fowasp-top-ten\n```\n\n### Pre-commit Hook\n```bash\n# .pre-commit-config.yaml\n- repo: https:\u002F\u002Fgithub.com\u002Freturntocorp\u002Fsemgrep\n  rev: v1.45.0\n  hooks:\n    - id: semgrep\n      args: ['--config=auto', '--error']\n```\n\n## Best Practices\n\n1. **Start with Baseline**\n   - Run initial scan to establish security baseline\n   - Prioritize critical and high severity findings\n   - Create remediation roadmap\n\n2. **Incremental Adoption**\n   - Begin with security-focused rules\n   - Gradually add code quality rules\n   - Implement blocking only for critical issues\n\n3. **False Positive Management**\n   - Document legitimate suppressions\n   - Create allow lists for known safe patterns\n   - Regularly review suppressed findings\n\n4. **Performance Optimization**\n   - Exclude test files and generated code\n   - Use incremental scanning for large codebases\n   - Cache scan results in CI\u002FCD\n\n5. **Team Enablement**\n   - Provide security training for developers\n   - Create internal documentation for common patterns\n   - Establish security champions program\n\n## Common Use Cases\n\n### New Project Setup\n```bash\n.\u002Fscripts\u002Frun-sast.sh --setup --language python --tools semgrep,sonarqube\n```\n\n### Custom Rule Development\n```yaml\n# See references\u002Fsemgrep-rules.md for detailed examples\nrules:\n  - id: hardcoded-jwt-secret\n    pattern: jwt.encode($DATA, \"...\", ...)\n    message: JWT secret should not be hardcoded\n    severity: ERROR\n```\n\n### Compliance Scanning\n```bash\n# PCI-DSS focused scan\nsemgrep --config p\u002Fpci-dss --json -o pci-scan-results.json\n```\n\n## Troubleshooting\n\n### High False Positive Rate\n- Review and tune rule sensitivity\n- Add path filters to exclude test files\n- Use nostmt metadata for noisy patterns\n- Create organization-specific rule exceptions\n\n### Performance Issues\n- Enable incremental scanning\n- Parallelize scans across modules\n- Optimize rule patterns for efficiency\n- Cache dependencies and scan results\n\n### Integration Failures\n- Verify API tokens and credentials\n- Check network connectivity and proxy settings\n- Review SARIF output format compatibility\n- Validate CI\u002FCD runner permissions\n\n## Related Skills\n\n- OWASP Top 10 Checklist\n- Container Security\n- Dependency Scanning\n\n## Tool Comparison\n\n| Tool | Best For | Language Support | Cost | Integration |\n|------|----------|------------------|------|-------------|\n| Semgrep | Custom rules, fast scans | 30+ languages | Free\u002FEnterprise | Excellent |\n| SonarQube | Code quality + security | 25+ languages | Free\u002FCommercial | Good |\n| CodeQL | Deep analysis, research | 10+ languages | Free (OSS) | GitHub native |\n\n## Next Steps\n\n1. Complete initial SAST tool setup\n2. Run baseline security scan\n3. Create custom rules for organization-specific patterns\n4. Integrate into CI\u002FCD pipeline\n5. Establish security gate policies\n6. Train development team on findings and remediation\n","# SAST Configuration\n\nStatic Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.\n\n## Use this skill when\n\n- Set up SAST scanning in CI\u002FCD pipelines\n- Create custom security rules for your codebase\n- Configure quality gates and compliance policies\n- Optimize scan performance and reduce false positives\n- Integrate multiple SAST tools for defense-in-depth\n\n## Do not use this skill when\n\n- You only need DAST or manual penetration testing guidance\n- You cannot access source code or CI\u002FCD pipelines\n- You need organizational policy decisions rather than tooling setup\n\n## Instructions\n\n1. Identify languages, repos, and compliance requirements.\n2. Choose tools and define a baseline policy.\n3. Integrate scans into CI\u002FCD with gating thresholds.\n4. Tune rules and suppressions based on false positives.\n5. Track remediation and verify fixes.\n\n## Safety\n\n- Avoid scanning sensitive repos with third-party services without approval.\n- Prevent leaks of secrets in scan artifacts and logs.\n\n## Overview\n\nThis skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL.\n\n## Core Capabilities\n\n### 1. Semgrep Configuration\n- Custom rule creation with pattern matching\n- Language-specific security rules (Python, JavaScript, Go, Java, etc.)\n- CI\u002FCD integration (GitHub Actions, GitLab CI, Jenkins)\n- False positive tuning and rule optimization\n- Organizational policy enforcement\n\n### 2. SonarQube Setup\n- Quality gate configuration\n- Security hotspot analysis\n- Code coverage and technical debt tracking\n- Custom quality profiles for languages\n- Enterprise integration with LDAP\u002FSAML\n\n### 3. CodeQL Analysis\n- GitHub Advanced Security integration\n- Custom query development\n- Vulnerability variant analysis\n- Security research workflows\n- SARIF result processing\n\n## Quick Start\n\n### Initial Assessment\n1. Identify primary programming languages in your codebase\n2. Determine compliance requirements (PCI-DSS, SOC 2, etc.)\n3. Choose SAST tool based on language support and integration needs\n4. Review baseline scan to understand current security posture\n\n### Basic Setup\n```bash\n# Semgrep quick start\npip install semgrep\nsemgrep --config=auto --error\n\n# SonarQube with Docker\ndocker run -d --name sonarqube -p 9000:9000 sonarqube:latest\n\n# CodeQL CLI setup\ngh extension install github\u002Fgh-codeql\ncodeql database create mydb --language=python\n```\n\n## Reference Documentation\n\n- Semgrep Rule Creation - Pattern-based security rule development\n- SonarQube Configuration - Quality gates and profiles\n- CodeQL Setup Guide - Query development and workflows\n\n## Templates & Assets\n\n- semgrep-config.yml - Production-ready Semgrep configuration\n- sonarqube-settings.xml - SonarQube quality profile template\n- run-sast.sh - Automated SAST execution script\n\n## Integration Patterns\n\n### CI\u002FCD Pipeline Integration\n```yaml\n# GitHub Actions example\n- name: Run Semgrep\n  uses: returntocorp\u002Fsemgrep-action@v1\n  with:\n    config: >-\n      p\u002Fsecurity-audit\n      p\u002Fowasp-top-ten\n```\n\n### Pre-commit Hook\n```bash\n# .pre-commit-config.yaml\n- repo: https:\u002F\u002Fgithub.com\u002Freturntocorp\u002Fsemgrep\n  rev: v1.45.0\n  hooks:\n    - id: semgrep\n      args: ['--config=auto', '--error']\n```\n\n## Best Practices\n\n1. **Start with Baseline**\n   - Run initial scan to establish security baseline\n   - Prioritize critical and high severity findings\n   - Create remediation roadmap\n\n2. **Incremental Adoption**\n   - Begin with security-focused rules\n   - Gradually add code quality rules\n   - Implement blocking only for critical issues\n\n3. **False Positive Management**\n   - Document legitimate suppressions\n   - Create allow lists for known safe patterns\n   - Regularly review suppressed findings\n\n4. **Performance Optimization**\n   - Exclude test files and generated code\n   - Use incremental scanning for large codebases\n   - Cache scan results in CI\u002FCD\n\n5. **Team Enablement**\n   - Provide security training for developers\n   - Create internal documentation for common patterns\n   - Establish security champions program\n\n## Common Use Cases\n\n### New Project Setup\n```bash\n.\u002Fscripts\u002Frun-sast.sh --setup --language python --tools semgrep,sonarqube\n```\n\n### Custom Rule Development\n```yaml\n# See references\u002Fsemgrep-rules.md for detailed examples\nrules:\n  - id: hardcoded-jwt-secret\n    pattern: jwt.encode($DATA, \"...\", ...)\n    message: JWT secret should not be hardcoded\n    severity: ERROR\n```\n\n### Compliance Scanning\n```bash\n# PCI-DSS focused scan\nsemgrep --config p\u002Fpci-dss --json -o pci-scan-results.json\n```\n\n## Troubleshooting\n\n### High False Positive Rate\n- Review and tune rule sensitivity\n- Add path filters to exclude test files\n- Use nostmt metadata for noisy patterns\n- Create organization-specific rule exceptions\n\n### Performance Issues\n- Enable incremental scanning\n- Parallelize scans across modules\n- Optimize rule patterns for efficiency\n- Cache dependencies and scan results\n\n### Integration Failures\n- Verify API tokens and credentials\n- Check network connectivity and proxy settings\n- Review SARIF output format compatibility\n- Validate CI\u002FCD runner permissions\n\n## Related Skills\n\n- OWASP Top 10 Checklist\n- Container Security\n- Dependency Scanning\n\n## Tool Comparison\n\n| Tool | Best For | Language Support | Cost | Integration |\n|------|----------|------------------|------|-------------|\n| Semgrep | Custom rules, fast scans | 30+ languages | Free\u002FEnterprise | Excellent |\n| SonarQube | Code quality + security | 25+ languages | Free\u002FCommercial | Good |\n| CodeQL | Deep analysis, research | 10+ languages | Free (OSS) | GitHub native |\n\n## Next Steps\n\n1. Complete initial SAST tool setup\n2. Run baseline security scan\n3. Create custom rules for organization-specific patterns\n4. Integrate into CI\u002FCD pipeline\n5. Establish security gate policies\n6. Train development team on findings and remediation\n",{"name":5,"metadata":45,"description":7},{"risk":26,"source":33,"date_added":46},"2026-02-27","main","2b749c82b5d11fac39d9a6e021ce3f5b8a541bd1","cli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fsast-configuration",3931,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates","https:\u002F\u002Faitmpl.com","https:\u002F\u002Fgithub.com\u002Fdavila7","https:\u002F\u002Fdanielavila.me","Building AI dev tools with LLMs","2026-11-14 06:14:46",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add davila7\u002Fclaude-code-templates --skill sast-configuration",{"tool":63,"command":64},"bunx","bunx skills add davila7\u002Fclaude-code-templates --skill sast-configuration",{"tool":66,"command":67},"pnpm","pnpm dlx skills add davila7\u002Fclaude-code-templates --skill sast-configuration","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fsast-configuration\u002FSKILL.md",true,[],[72,103,130,162,197,220],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":83,"publishedAt":40},"01M70NHBTQ8BV0A2SCAZXEPHCX","wealthville-pool-scoring","Score DeFi liquidity pools before providing liquidity. Returns a 0-100 pool score and an Enter\u002FHold\u002FExit\u002FReduce\u002FAvoid verdict with calibrated confidence for ~68,800 Solana pools and 575 EVM pools, plus a public miss-inclusive track record. Use when asked whether a pool is worth LPing into, which pools look best right now, or how accurate the scores have actually been.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fweb-data\u002Fwealthville-pool-scoring\u002FSKILL.md",[78],{"categoryNo":79,"categoryName":80,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[84,85,86,87,88,27,89,90,91,92,93,94,95,96,97,98,99,100,101,102],"scoring","pool","wealthville pool scoring","liquidity","which","exit","now","use","when","reduce","with","record","track","verdict","evm","solana","how","public","look",{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":110,"publishedAt":40},"01M70MB6VR8ERJ4EM8D5KHBMEV","technical-debt-auditor","Scans a codebase and produces a quantified technical debt report with a prioritized remediation plan. Analyzes dead code, TODO\u002FFIXME\u002FHACK markers, dependency staleness, complexity hotspots, code duplication signals, test coverage gaps, unused exports, and outdated patterns. Use this skill when the user asks to audit their codebase for tech debt, wants a health check of their code quality, says things like \"where should I focus refactoring\", \"find code smells\", \"audit my codebase\", \"what technical debt do we have\", \"prioritize cleanup work\", or asks about code quality metrics. Also trigger when the user mentions \"code rot\", \"legacy cleanup\", \"refactoring priorities\", or wants to understand the overall health of a project before a major effort. Trigger even if the user doesn't say \"technical debt\" explicitly — any request to systematically assess code quality and identify improvement priorities belongs here.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Ftechnical-debt-auditor\u002FSKILL.md",[109],{"categoryNo":79,"categoryName":80,"taxonomyType":81,"taxonomyTypeDesc":82},[111,112,113,114,115,116,117,118,119,120,121,92,122,123,124,125,126,127,128,129],"technical debt","debt","technical","technical debt auditor","auditor","coverage","complexity","markers","project","cleanup","unused","code","todo","work","plan","focus","signals","audit","dependency",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":145,"publishedAt":40},"01M70KPYH9QNHCNME5GJQGE22K","readonly-sql-guard","Make an agent's database access provably read-only. Use when an agent runs caller-supplied SQL against a production\u002FERP\u002Fanalytics database (a \"query\" MCP tool, text-to-SQL, an admin console), or when reviewing DB-access code for write\u002FDDL\u002Fside-effect\u002Ftransaction-escape risks. Checks what a statement CALLS, not just its shape.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdatabase\u002Freadonly-sql-guard\u002FSKILL.md",[136,139,140],{"categoryNo":137,"categoryName":138,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":79,"categoryName":80,"taxonomyType":81,"taxonomyTypeDesc":82},{"categoryNo":141,"categoryName":142,"taxonomyType":143,"taxonomyTypeDesc":144},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[146,147,148,149,150,151,152,27,153,154,155,36,156,157,158,91,159,160,92,161],"readonly","guard","sql guard","sql","readonly sql guard","erp","effect","read-only","db","just","calls","only","MCP","access","database","query",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":166,"licenseFileUrl":167,"sourceHtmlUrl":168,"categories":169,"keywords":173,"publishedAt":40},"01M6AFY6F7CC2BBZP1QD6VTNVC","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FSKILL.md",[170],{"categoryNo":171,"categoryName":172,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000009","前端开发",[174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,27,196],"artifacts builder","web","web artifacts builder","artifacts","builder","state","routing","state management","component","css","frontend","ui","Tools","file","components","shadcn","react","Tailwind","suite","jsx","html","single-file","ui components",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":166,"licenseFileUrl":201,"sourceHtmlUrl":202,"categories":203,"keywords":208,"publishedAt":40},"01M6AFWF33SFV9Z3SF4PEEE4BF","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FSKILL.md",[204,207],{"categoryNo":205,"categoryName":206,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":171,"categoryName":172,"taxonomyType":81,"taxonomyTypeDesc":82},[209,23,210,211,212,175,213,184,185,214,215,216,217,27,218,94,219],"webapp testing","webapp","browser","playwright","applications","debugging","toolkit","logs","screenshots","local","behavior",{"skillNo":221,"name":222,"nameZh":6,"description":223,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":166,"licenseFileUrl":224,"sourceHtmlUrl":225,"categories":226,"keywords":234,"publishedAt":40},"01M6AF67Q67JJJ5V51JR2P52KA","discernment-nudge","After you give a substantive answer or draft that the user may act on — advice or recommendations, drafted artifacts such as goals, plans, pitches, proposals, or emails, estimates or projections, analysis or interpretation of data, factual claims they may rely on, or a multi-step argument — invoke this skill BEFORE finalizing your reply and then, if it applies, append 2-3 short follow-up questions, each tied to something specific in what you just produced, that help the user check key facts, probe the reasoning or assumptions, and notice missing context. Do this at most once per conversation. Skip it when the user asked a trivial how-to or simple lookup, wants a purely educational explanation, asked you only to format, convert, or assemble a file from content they provided, is writing code they will run, is doing creative writing or casual chat, or already asked you to double-check, cite, or review — the skill file explains these boundaries and the exact output format.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FSKILL.md",[227,230,231],{"categoryNo":228,"categoryName":229,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":79,"categoryName":80,"taxonomyType":81,"taxonomyTypeDesc":82},{"categoryNo":232,"categoryName":233,"taxonomyType":143,"taxonomyTypeDesc":144},"01JBSEEDCAT000000000000036","内容创作者",[235,236,237,238,239,240,241,242,177,243,187,122,244,245,246,247,248,157,249,92,250,251,252,253,254,100,255],"discernment nudge","nudge","interpretation","help","run","reasoning","data","writing","lookup","content","review","conversation","short","up","invoke","you","analysis","claims","argument","assemble","recommendations"]